abrt is vulnerable to arbitrary code execution. The /usr/libexec/abrt-action-install-debuginfo-to-abrt-cache
tool does not sufficiently sanitize its environment variables, allowing arbitrary Python modules to be loaded and run from non-standard directories such as /tmp
. A local attacker is able to execute arbitrary code by modifying the PYTHONPATH
environment variable to reference a malicious Python module.